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We propose a communication protocol exploiting corre- 
lations between two events with a definite time-ordering: a) 
the outcome of a weak measurement on a spin, and b) the 
outcome of a subsequent ordinary measurement on the spin. 
In our protocol, Alice, first generates a "code" by performing 
weak measurements on a sample of N spins. The sample is 
sent to Bob, who later performs a post-selection by measur- 
ing the spin along either of two certain directions. The results 
of the post-selection define the "key" , which he then broad- 
casts publicly. Using both her previously generated code and 
this key, Alice is able to infer the direction chosen by Bob in 
the post-selection. Alternatively, if Alice broadcasts publicly 
her code. Bob is able to infer from the code and the key the 
direction chosen by Alice for her weak measurement. Two 
possible experimental realizations of the protocols are briefiy 
mentioned. 

Weak measurements are a special class of quan- 
tum measurements explored in recent years by Aharonov, 
Vaidman, and others. In one such measurement of any 
given observable A, the disturbance caused to the system 
is minimized at the expense of precision in a single trial. 
Nevertheless, after a large number trials one can deter- 
mine statistical averages such as the expectation value of 
A. The distinctive feature of weak measurements has to 
do with the observed averages when the measured sys- 
tem is post-selected. Such averages, the so-called weak 
values, may lie outside the bounds of the spectrum of 
A H]. Moreover, since they depend on the chosen pre- 
and post-selected ensemble, weak values carry non-trivial 
information about the choice of measurement used for 
post-selection. In accordance with causality, these un- 
usual regularities must therefore be a priori undetectable, 
i.e., "hidden in the noise" Hence, they can only 

be extracted a posteriori, from the correlations between 
readings of the measurement and the result of the post- 
selection. 

In the two protocols suggested in this Letter, such cor- 
relations are used for signaling. In the first protocol, the 
receiver, Alice, starts by generating a code correspond- 
ing to the outcomes of a series of weak measurements on 
a large sample of spins. She then hands them to Bob, 
who is about to depart on a long voyage, together with 
an important question that he can only answer at some 
later time. When he is ready to respond, Bob performs 
an ordinary measurement (post-selection) on these spins. 
His response corresponds to the choice of spin component 
he then measures; for instance, a measurement of ay to 
signal a "yes" ( "I will marry you" ) , or a measurement 
of (Tz to signal a "no" . The random sequence of results 
obtained in either of these measurements plays the role 



of a key, which he then broadcasts publicly. This is just 
enough information for Alice to bin her previous read- 
ings and extract the message from the weak values. The 
random key is useless to the ever-jealous Eve; it can be 
shown that an optimal sample size exists which is still 
too small for Eve to infer Bob's choice from the statistics 
of the key. 

The security of this protocol is however compromised 
if the spins fall in the hands of the eavesdropper. This 
drawback is overcome in the second protocol, in which 
instead it is Alice who sends the message; for this, she 
performs on the N spins either of two possible weak mea- 
surements and generates a code corresponding to her out- 
comes. She then sends the spins and the code to Bob. 
To decode the message Bob post-selects the spins by per- 
forming a sequence of strong measurements. As in the 
first case, the resulting key allows him to bin the code 
and deduce from the weak values Alice's choice of mea- 
surement. In this case, Eve cannot intercept the message 
from the spins without Bob being aware of her actions. 

We begin by analyzing the weak measurement scheme. 
Suppose that Ahce prepares a sample of N spin- 1/2 par- 
ticles, in the eigenstate of ax, and she wishes to 
perform a weak measurement of the spin observable 
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{ax + ay) , 
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with eigenstates |a±). We let p be the pointer variable 
of the measuring device and \4>i) its initial state, with a 
Gaussian wave function = (27rAp^)~^/^e~P ^^^^ 

of uncertainty Ap. The weak measurement may then be 
described by the usual transformation taking an initial 
product state I'i'i) = of the spin and the device, 

to a final entangled state: 



(2) 



where c± — {a ± \x+), and \(f>±) is j^i) shifted in p by 
±1. In contrast however to an ordinary measurement, 
Ap is here assumed to be so large that the shifted states 
|0±) overlap considerably. Nevertheless, the expectation 
value of p is still shifted by the usual expectation value 
(A): 
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The idea of a weak measurement is thus to extract such 
systematic shifts of the means from a large sample of 
identically prepared spins, ensuring at the same time a 
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minimal disturbance of any individual spin. This distur- 
bance is naturally related to the overlap between \4>+) 
and \(p—). 

A convenient measure of disturbance D is given in 
terms of the Fidelity Q as 13 = 1 — JF, where J- is 
defined as the probability of obtaining back the initial 
state after the weak measurement, T = + l^*/)!!^; 
hence, D may be interpreted as the probability of "flip- 
ping" the initial direction of the spin. As one verifies, D 
involves the overlap factor (0 + = e~^l'^^'P : 



where, in terms of D, 
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We assume in the approximation that D is small and take 

Together then with the weakness condition D 1, 
the resulting distribution for the pointer variable must 
be sufficiently broad that the spectrum of A cannot be 
resolved. The distribution therefore takes essentially a 
Gaussian form, centered at the expectation value (A), 
with a large uncertainty a/ Ap"^ + AA'^ ~ Ap of order 
D~^/'^. Since in N identical and independent trials the 
expected sample mean \s p — {A) ± Ap/^/N, Alice can 
determine (A) if her sample is large enough. 

But now suppose that after completing her measure- 
ments Alice gives the spins to Bob, who later performs a 
second, now ordinary measurement on each spin, along 
some arbitrary direction b with possible outcomes \b±). 
Each outcome in this post-selection is correlated with a 
particular response of the measuring device. To keep 
track of these correlations it is convenient to re-express 
the combined state of the system and apparatus in terms 
of the basis |6±) 



\^f)^\b+mb+)) + \b-mb-)). 
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where the conditional response of the apparatus is de- 
scribed by the unnormalized states \4>{b±.)) ~ {b± l^*/). 
For a given result \b), 
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here C = (^12^+) and Ay^ is the weak value of A, defined 
as 
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The weak value A^{b) is the defining property of weak 
measurements: as before, when D is small the pointer 
distribution is essentially Gaussian of uncertainty ~ Ap; 
however, as one can easily show, the location of the mean 
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The correction is the relative deviation of the prob- 
ability P'(fe) = (0(6)10(6)) of obtaining \b) in the presence 
of the weak measurement, as measured from the unper- 
turbed probability P{b) = \ {b\4>)\'^ ■ We see therefore that 
the average conditional reading becomes the real part of 
the weak value Aw{b) as we approach the ideally weak 
situation in which the transition probability is left unal- 
tered by the measurement. 

To summarize then: if Alice starts with a large sam- 
ple of N identical spins, she obtains a broad distribution 
of pointer readings with a sample mean (A) ± Ap/\/N; 
however, were she to know- /or every single spin- which of 
the two possible outcomes and |6— ) was obtained in 
Bob's measurement, then she could divide her readings 
into two categories, corresponding to two post-selected 
sub-samples of size N± ~ NP{bzt). Her original distribu- 
tion would then break up as a mixture of two conditional 
distributions, with sample means A^(6+) and Aw{b~) 
within errors of Ap/yjN±. The break-up is captured by 
a simple sum rule H in the limit D 



{A) ^ P{b) ReA^(6) + P(b-) ReA^(b-) , 



(10) 



which serves as the basis for our protocol. 

For simplicity let us first consider a complete cycle 
at the end of which Alice receives from Bob a single- 
bit "yes" or "no" message. When Alice prepares her 
spin sample in the eigenstate |x-f), she labels each spin 
as i — 1 , ..N. From her N weak measurements of 
-^(fJa; + (Ty), she then generates the code by recording a 
string of real numbers corresponding to the pointer read- 
ings {pi,p2, --Pn}', the sample mean P = jj ^iPi should 
yield the expectation value {A) ~ Next the spins 

are given to Bob, carefully keeping track of the ordering. 
Now it's his turn to send the message. If Bob decides to 
send a "yes" , he measures ay on every single spin; other- 
wise he measures az to signal a "no" . In either case, from 
the resulting sequence of outcomes he generates the key: 
an ordered list of N bits {ki, k2, ... where, say, h = 1 
and respectively correspond to the outcomes "up" and 
"down" for the the i-th spin. It is this key which Bob 
sends back to Alice using an insecure channel. As the key 
is effectively random by virtue of the fact that y and z lie 
on the equal-probability plane, the uncorrelated sequence 
of "1" and "0"'s will be useless to the eavesdropper. 

On the other hand, Alice, upon receiving the key, may 
go back to her code and separate each reading pi into 
either of two bins, depending on whether A:^ = 1 or 0. 
Finally, she computes the mean values of p in each bins 
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She takes these values as esti mate s of the "true" means 
within errors of order /S.p/ N /2. Now, if indeed Bob 
sent a "yes", then she should see that pQ ~ ) = 0, 

and an "eccentric" weak value pi ~ Aw{y+) — \/2- In- 
stead, if Bob sent a "no" , then she will find no significant 
deviation in either of the two means pi or po; for this case, 
the real part of Aw{z±) coincides with the sample mean 
of {A) — l/\/2- Thus, by distinguishing between a non- 
trivial and a trivial break-up of the sample mean, Alice 
can decode Bob's single-bit message 
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FIG. 1. Schematic of a cycle from which Alice receives a 
"yes" response from Bob. 

One may object that due to the small disturbance of 
the weak measurements, the average numbers of "1" 's 
and "0" 's in the key are no longer identical for the two fi- 
nal measurements of CTj, and cr^. Indeed, by eq. (H), there 
is no change in the probabilities for the measurement 
along z, but for the measurement along y the relative 
change in the probabilities is 5P{y±.)/ P{yzL) = ±2D. 
The difference may then be used by Eve to distinguish 
between the two messages if the string is sufficiently long. 
This leads us to compare the minimal sample sizes Ne 
and Na, respectively, required by Eve and Alice to ex- 
tract the message from their available data. Alice needs 
to distinguish between the statistics with means \/2 and 
0. Hence she requires that \/2 > Ap/ ^/Na/2, which 
by eq. @) yields Na ^ 1/D. On the other hand. Eve 
must distinguish between the relative frequencies of "1" 's 
of 1/2 for "no" and 1/2 zL D for "yes", with an uncer- 
tainty in the frequencies A/ ~ l/2\//V ; for this she needs 
Ne ^ trials. The ratio between the two optimal 

sample sizes therefore scales like ^ ^ jj and conse- 
quently, for a sufficiently small D, an optimal value N 
may be chosen such that Ne ^ N > Na ensuring that 
the key is safe. 

While this protocol is particularly interesting from the 
conceptual point of view as we further discuss below, it 
would fail to meet usual cryptography security require- 
ments had Alice sent the spins to Bob using a public 



channel. In such case, Eve could have intercepted the 
message by performing weak measurements and using 
the public key sent by Bob . The security drawback is 
avoided in the second protocol, where by a similar set of 
measurements, Alice sends a message to Bob. 

As before, Alice starts with N spins in the |a;+) state. 
To send a "yes" she next performs, on each spin sepa- 
rately, a weak measurement of {ax + ay)/^/2. To send 
a "no" she measures weakly {ax — ay)/\/2. In either 
case she records the results as a code of N real numbers, 
and sends to Bob publicly both the code and the spins. 
To decode the message Bob decides in a random man- 
ner to perform on each spin an ordinary measurement, 
of either ax or ay. The ax measurement is needed as 
a "security check" , while the results of the ay measure- 
ment will be used to decode the message. If the spins 
were not disturbed after Alice's measurement, in ~ N/2 
cases that Bob measures ax he gets ax — 1 and only 
^ ND < N/A times ax ^ -l- On the other hand, he 
finds ay = ±1 with nearly equal probability. The lat- 
ter are used to bin the code, into two subsamples each 
with ~ N/4 spins, corresponding to the post-selection of 
ay = 1 and ay = — 1 . Finally he computes the mean value 
of each subsample. If Alice had measured {ax + ay)/V2, 
Bob will find the weak values V2 and 0, respectively. If 
instead she had measured {ax — ay)/^/2, he will find the 
same means but in reverse order. 

To discuss the question of security, notice that the 
weak measurements rotate the spin to two slightly dif- 
ferent spin states. For a typical reading p = l/^/2± Ap, 
the overlap between the two rotated states is of the or- 
der of 1 — -D, as they lie at angle of ~ Vd from x+. 
Now, since Bob requires N ~ 1/D to decode the mes- 
sage, the overlap between the two "yes/no" collective N- 
spin states becomes nearly orthogonal. The crucial point 
is that now there are two distinct ways to distinguish 
between these states. The first, Bob's method of post- 
selecting the spins separately, is not available to Eve; for 
instance, if she post-selects in the ay direction. Bob will 
notice that the mean of ax changed. An alternative is 
then for Eve to perform a collective projection. How- 
ever, in order to determine which projector she needs to 
measure in the 2^-dimensional Hilbert space. Eve must 
be in possession of the code before she gets the spins. 
This information can therefore be concealed from Eve 
if Alice sends the code after the spins have passed by 
Eve, or if she sends the spins only one at a time. It can 
further be shown that by separate spin measurements, 
which rotate the spin by less than ^/D, Eve cannot gain 
information. The security of the protocol, hence rests 
on two ingredients: the non-commutativity of Bob's final 
measurements, as in key distribution protocol |^], and a 
temporal separation between the spins and the code or 
between spins themselves. Such a temporal delay was 
suggested by Goldenberg and Vaidman However the 
latter proposal requires the use of a quantum storage 
which is not needed in our case; Bob can complete his 
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measurements before receiving the code. 

A simple quantum optical realization of the protocols 
should be feasible following a previous proposal [ p^JTl| 
for observing weak values through the interaction of a co- 
herent state in a high-Q resonant cavity with a pre- and 
post-selected Rydberg atom. Here the photon occupation 
number plays the role of the pointer variable. Another re- 
alization may employ EPR-type correlations in a photon- 
pair generated via parametric down conversion process. 
In this case, one will perform a weak-measurement on one 
photon and an ordinary measurement on the other. Weak 
measurements of polarization have been suggested [ p^Jl3| 
and carried out for classical light 15|. In the present 
case, one step further is required, since the measurement 
must be performed on each photon separately. 

To conclude with, it is conceptually instructive to com- 
pare the present suggestion to the Bennett- Wiesner com- 
munication scheme [ [L6[ : Alice prepares an EPR pair and 
sends one of the particles to Bob. When Bob wishes to 
send a 2-bit message to Alice, he performs a tt rotation 
of his spin around the x, y ov z axis, or does nothing. 
He then sends the spin back to Alice, who can reveal his 
actions by measuring a joint observable. This scheme, 
as well as other well known schemes such as teleporta- 
tion or quantum key distribution ordinarily 
rely on entanglement and its preservation [|l9| . While 
in the present proposal the weak measurement can be 
formulated in terms of entanglement between the mea- 
suring device and the system, as in eq. the order 
of events is here such that the entanglement is no longer 
"there" once the reading of the weak measurement has 
been recorded. 

How should we then understand the flow of information 
in the present case? Bennett and Wiesner suggested after 
Schumacher, that since in their scheme only one qbit is 
returned to Alice while two bits of information are trans- 
mitted, " one hit of information is sent forward in time... 
while the other hit is sent backwards in time to the EPR 
source, then forward in time through the untreated parti- 
cle" . In our first example, because the code is prepared 
before Bob sends his message, and because no useful in- 
formation can be extracted from the key, the message is 
in some sense already "in" the code. It seems therefore 
that the full one bit of information is sent backwards in 
time. Yet, it is only with the aid of the post-selected 
"key" that the message is extracted from the quantum 
noise. Therefore, no conflict arises between macroscopic 
causality and this apparently retrocausal flow of infor- 
mation. 
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